The ChipSHOUTER® (CW520) is a fully-featured Electromagnetic Fault Injection (EMFI) platform that can be used to discover and characterize vulnerabilities in embedded systems. ChipSHOUTER makes EMFI available to test labs, engineering development firms, educators, and embedded enthusiasts. With a flexible API and bundled practice targets, the system is a platform for experimentation and education right out of the box. Paired with an X-Y table and basic python scripting the ChipSHOUTER becomes a fully automatable EMFI platform capable of precision testing and fault characterization. This kit is designed for conducting attacks and testing in-situ, without the need to use special development boards or to modify the target board.
ChipSHOUTER uses low-ESR capacitors to dump up to 500V through various E.M. probes. Digital control of charge voltage and fast response times provide you with the E.M. fault injection tool to simplify your fault investigations. Electromagnetic Fault Injection is a powerful attack method that requires careful consideration of how it might apply to your products.
Learn more about EMFI here.
White Paper: Electromagnetic Fault Injection (EMFI) for Automotive Safety & Security Testing with ChipSHOUTER®
150 to 500 V Charge Voltage.
Hardware input with sub-nS jitter, allowing highly accurate injection timings.
Python API for easy control and scripting.
Oscilloscope output monitors to see actual glitch inserted into probe tip.
Comes with 4 probe tips of varying size and polarities.
Included Ballistic Gel & Simple EMFI Target for validating EMFI settings.
Optional cooling air input for near-continuous use.
Ballistic Gel EMFI Target
A unique SRAM-based EMFI target includes a large SRAM array. By injecting faults into the array, you can count individual bit flips occurring with different pulse parameters.
You can even see some physical location effects by mapping the SRAM location to address location.
Built for Scripting
The Python 3 API easily allows usage with existing systems, such as connecting an XY table to the ChipSHOUTER setup to scan a device surface.
The ChipSHOUTER also features a simple serial terminal to allow you to use the unit interactively.
A built-in pulse generator allows generating pulses on computer command. For a high-resolution temporal location, a hardware trigger input directly drives the pulse output. This can be controlled by a ChipWhisperer, pulse generator, or custom FPGA board.
Hardware Trigger Input
Charge Voltage Range
150V to 500V
Inserted Pulse Min Width (1mm tip)
15 nS (TYP)
Inserted Pulse Max Width (1mm tip)
80 nS (TYP)
Inserted Pulse Min Width (4mm tip)
24 nS (TYP)
Inserted Pulse Max Width (4mm tip)
480 nS (TYP)
Hardware Input Trigger: Delay (Typ)
75 nS (TYP)
Hardware Input Trigger: Delay Jitter
150 pS std-dev (TYP)
Hardware Input Trigger: Width Jitter (300 to 500V)
220 pS std-dev (TYP)
ChipSHOUTER Main Unit
ChipSHOUTER CW520 Main Device
Ballistic Gel Target
CW521 Ballistic Gel SRAM Target Board
USB A Cable
USB cable for CW521 Ballistic Gel
Simple EMFI Target
CW322 Simple EMFI Target + Battery
Injection Probe Tip Set
1mm, 4mm probe tip set (4 probes total)
Oscilloscope probe adapter
Oscilloscope probe adapters for Voltage & Current Measurement
Isolated USB Interface
Isolated USB-Serial Adapter
RJ12 Serial Cable
RJ12 Straight-Thru Data Cable
Micro-USB Cable (3 ft)
Micro-USB Cable for Isolated USB-Serial Adapter
SMB to SMA Adapter
SMA adapter for hardware pulse input connector
SMB to BNC Adapter
BNC adapter for hardware pulse input connector
SMB cable for hardware pulse input connector
Coolin air adapter
Flex tube adapter for air inlet
Wrench to remove air adapter blanking plug
Right angle SMA Adapter
Adapter when mounting ChipSHOUTER horizontally
GLOBAL AUTHORIZED DISTRIBUTOR
FREE INTERNATIONAL SHIPPING
Outside the USA
CUSTOMS & TAXES
Shop in local currency
Request formal quotes
SHOP THE LATEST PRODUCTS